diff options
| author | Sairam Venugopal <vsairam@vmware.com> | 2018-11-14 12:07:28 -0800 |
|---|---|---|
| committer | Alin Gabriel Serdean <aserdean@ovn.org> | 2018-11-15 17:00:28 +0200 |
| commit | faaf9671a97d28b1268baa47e1c62562fd73355f (patch) | |
| tree | 5e5bb0166913fe6a9e048d88965a0d4139f14bbd | |
| parent | 1108540e479cda8abac57f393ec184c4c22de18a (diff) | |
| download | openvswitch-faaf9671a97d28b1268baa47e1c62562fd73355f.tar.gz | |
datapath-windows: Fix invalid reference in Buffermgmt.c
OVS_BUFFER_CONTEXT gets cleared as part of NdisFreeNetBufferListContext
function call. This causes an invalid reference error.
Found while testing with driver verifier enabled.
Signed-off-by: Sairam Venugopal <vsairam@vmware.com>
Acked-by: Anand Kumar <kumaranand@vmware.com>
Acked-by: Alin Gabriel Serdean <aserdean@ovn.org>
Signed-off-by: Alin Gabriel Serdean <aserdean@ovn.org>
| -rw-r--r-- | datapath-windows/ovsext/BufferMgmt.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/datapath-windows/ovsext/BufferMgmt.c b/datapath-windows/ovsext/BufferMgmt.c index 7ec073b70..910983b25 100644 --- a/datapath-windows/ovsext/BufferMgmt.c +++ b/datapath-windows/ovsext/BufferMgmt.c @@ -1435,6 +1435,7 @@ OvsCompleteNBL(POVS_SWITCH_CONTEXT context, { POVS_BUFFER_CONTEXT ctx; UINT16 flags; + UINT32 dataOffsetDelta; PNET_BUFFER_LIST parent; NDIS_STATUS status; NDIS_HANDLE poolHandle; @@ -1465,6 +1466,7 @@ OvsCompleteNBL(POVS_SWITCH_CONTEXT context, nb = NET_BUFFER_LIST_FIRST_NB(nbl); flags = ctx->flags; + dataOffsetDelta = ctx->dataOffsetDelta; if (!(flags & OVS_BUFFER_FRAGMENT) && NET_BUFFER_DATA_LENGTH(nb) != ctx->origDataLength) { UINT32 diff; @@ -1479,7 +1481,7 @@ OvsCompleteNBL(POVS_SWITCH_CONTEXT context, } } - if (ctx->flags & OVS_BUFFER_PRIVATE_CONTEXT) { + if (flags & OVS_BUFFER_PRIVATE_CONTEXT) { NdisFreeNetBufferListContext(nbl, sizeof (OVS_BUFFER_CONTEXT)); } @@ -1550,7 +1552,7 @@ OvsCompleteNBL(POVS_SWITCH_CONTEXT context, #ifdef DBG InterlockedDecrement((LONG volatile *)&ovsPool->fragNBLCount); #endif - NdisFreeFragmentNetBufferList(nbl, ctx->dataOffsetDelta, 0); + NdisFreeFragmentNetBufferList(nbl, dataOffsetDelta, 0); } if (parent != NULL) { |